Oke, I got this working, it still needs some optimalization.

Two things needed to be done:

one add the event in the contribution:

<?xml version="1.0"?>
<component name="WorkspaceCreationListener">
    <extension target="org.nuxeo.ecm.core.event.EventServiceComponent" point="listener">
        <listener name="documentCreated" async="false" postCommit="false" priority="120"
                  class="WorkspaceCreationListener">
            <event>documentCreated</event>
        </listener>
    </extension>
</component>

Two: Make use of the unrestrictedRunner

public class WorkspaceCreationListener implements EventListener {


private static final String TENANT_GROUP_PREFIX = "tenant-" ;
private static final String TENANT_ADMINISTRATORS_GROUP_SUFFIX = "_tenantAdministrators";


@Override
public void handleEvent(Event event) throws ClientException {
    if (event.getName().equals("documentCreated")){
        EventContext ctx = event.getContext();



        if (!(ctx instanceof DocumentEventContext)) {
            return;
        }
        DocumentModel doc = ((DocumentEventContext) ctx).getSourceDocument();
        if (doc == null) {
            return;
        }
        if (doc.getType().equals("Workspace")){
            String tenantId = ((NuxeoPrincipal) ctx.getPrincipal()).getTenantId();
            try {
                process(doc,ctx.getPrincipal().toString(),tenantId);
            } catch (Exception e) {
                e.printStackTrace();  //To change body of catch statement use File | Settings | File Templates.
            }

        }
    }
}

public void process(DocumentModel doc, String userId, String tenantId) throws Exception {
    setACEs(doc,userId,tenantId);
    setACEs(doc,computeTenantAdministratorsGroup(tenantId),tenantId);

/* doc.setPropertyValue("creator", emet);  perhap to position, i'm not enough sure */
}

public static String computeTenantAdministratorsGroup(String tenantId) {
    return TENANT_GROUP_PREFIX + tenantId
            + TENANT_ADMINISTRATORS_GROUP_SUFFIX;
}

private void setACEs(DocumentModel doc, String userId, String tenantID) throws Exception {
    AceSetter setter = new AceSetter(doc,userId,tenantID);
    setter.runUnrestricted();
}

protected class AceSetter extends UnrestrictedSessionRunner {

    private final DocumentModel doc;
    private final String userId;


    public IterableQueryResult ids = null;


    private String username;

    protected AceSetter(DocumentModel doc, String userId,String repositoryName)
            throws Exception {
        super("default");
        this.doc = doc;
        this.userId = userId;
    }


    @Override
    public void run() throws ClientException {

        ACP acp =null;
        DocumentModel doc2 = session.getDocument(new PathRef(doc.getPath().toString()));
        try{
            acp = doc2.getACP();
        }
        catch (Exception e){

        }

        if (acp==null){
            acp =new ACPImpl();
        }
        ACL acl = acp.getOrCreateACL();
        int WorkspaceAdminACEIndex = acl.indexOf(new ACE(this.userId, SecurityConstants.EVERYTHING, true));
        if (WorkspaceAdminACEIndex == -1) {
            ACE ace = new ACE(this.userId, SecurityConstants.EVERYTHING, true);
            acl.add(0,ace);
            acp.addACL(acl);
            doc2.setACP(acp, true);
        }
    this.session.saveDocument(doc2);
    this.session.save();
    }
}

}

I hope this helps someone :-)

Bauke Roo